PROJECT-03 / Cloud governance
AWS Multi-Account Zero-Trust Architecture Lab
A multi-account AWS landing-zone lab focused on governance, isolation, audit logging, and validation.
- State
- Active Engineering
- Platform
- AWS / AWS Organizations
01 /Security Objective
Design and validate a secure multi-account AWS landing zone with preventative and detective controls.
Category: Cloud governance
02 /Architecture Overview
AWS Organizations separates security, log archive, production, and development accounts to limit blast radius.
Platform scope
- AWS
- AWS Organizations
CONTROL /Controls in Scope
- SCPs
- CloudTrail
- GuardDuty
- Permission boundaries
03 /Implementation Record
Terraform manages Organizations, SCPs, CloudTrail, IAM, and GuardDuty delegation.
- Delivery
- Terraform-managed organizations and policies
04 /Validation Record
- Validation method
- Terraform outputs, console verification, AWS CLI attack simulations, CloudTrail evidence, and drift checks.
- Evidence record
- AWS CLI tests, CloudTrail logs, and drift checks
WORKFLOW /Engineering Lifecycle
- 01Design
- 02Implement
- 03Deploy
- 04Validate
- 05Test controls
- 06Destroy
- 07Document evidence
05 /Current State & Limitations
Active Engineering
The repository describes a controlled engineering lab, not a production landing zone.
RELATED /Published Engineering Write-ups
Medium
Designing a Zero-Trust AWS Governance Architecture Using AWS Organisations, SCPs, and CloudTrailHashnodeMay 2026
Building a Multi-Account Zero-Trust Governance Architecture in AWS Using Terraform, SCPs, and CloudTrailDEV
Built a Multi-Account Zero-Trust Governance Architecture in AWS using Terraform, AWS Organisations, SCPs, and CloudTrail.